{"id":"CVE-2012-1823","kind":"vulnerability","aliases":["CVE-2012-1823"],"related":[],"title":"PHP PHP: PHP-CGI Query String Parameter Vulnerability","description":"sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.","summary":"PHP built/run as CGI (php-cgi, e.g. Apache mod_cgi/cgid or ScriptAlias setups) passes query strings with no '=' (such as ?-s or ?-d...) to the binary as command-line options. An unauthenticated remote attacker can read PHP source or run code as the web server user (auto_prepend_file via php://input). Affects PHP before 5.3.12 and 5.4.0-5.4.1 (NVD). Actively exploited; KEV-listed.","severity":"critical","cvss":9.8,"epss":0.99998,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"PHP PHP","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"PHP","fixed":["5.3.13","5.4.3"],"affected":"< 5.3.12, >= 5.4.0, < 5.4.2 (php-cgi only)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apache","exploited","php","php-cgi","rce","runtime","self-hosted"],"not_affected_if":["fastcgi-only","managed-hosting","mod_php","mod_php-or-php-fpm","php-cli-only","php-fpm"],"how_to_check":"Run 'php -v' and 'php-cgi -v'; anything below 5.3.13 / 5.4.3 is at risk if served through CGI. Check whether php-cgi is wired to the web server: grep for 'php-cgi', 'AddHandler cgi-script', 'ScriptAlias' or 'Action application/x-httpd-php' in Apache/nginx config. Quick test on a non-production host: request /index.php?-s ; if you get highlighted PHP source back, you are vulnerable. PHP-FPM, mod_php and FastCGI-only setups are not affected by this path.","fix":"Upgrade to PHP 5.3.13 / 5.4.3 or later (CERT/CC; 5.3.12 / 5.4.2 was the first fix), preferably a currently supported PHP 8.x since 5.x is long end-of-life. Distro packages: RHSA-2012:0546 etc. Workaround: switch to PHP-FPM or mod_php; or Apache rule: RewriteCond %{QUERY_STRING} ^(%2d|-)[^=]+$ [NC] then RewriteRule ^(.*) $1? [L].","status":"resolved","published_at":"2012-05-11T10:15:48+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:22:06+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-10-23T21:22:06Z","model":"claude-haiku-5-5","output":{"fix":"Apply the PHP update per vendor instructions; move off CGI mode to PHP-FPM or mod_php if CGI is in use.","reach":"internet","impact":"high","summary":"PHP running in CGI mode does not handle query strings safely, so a remote request whose query string is read as command-line options can make the server run attacker-supplied code. The flaw is listed in CISA's known-exploited catalog and EPSS scores it at 1.000, meaning exploitation is observed in the wild.","category":"runtime","who_cares":["php","self-hosted","php-cgi"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker runs arbitrary code on the web server.","analyst_note":"Confirm the fixed PHP versions and whether php-cgi is enabled on common hosts; sources do not list them (see CISA KEV entry and NVD CVE-2012-1823).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["mod_php-or-php-fpm","php-cli-only"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000482,"input_tokens":2830,"output_tokens":398,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed PHP versions and whether php-cgi is enabled on common hosts; sources do not list them (see CISA KEV entry and NVD CVE-2012-1823).","search":"'-1823':12A,15A '-2012':11A,14A '5.3.12':86B,100C '5.4':102C '5.4.0':88B '5.4.1':89B '5.4.2':105C 'activ':91B 'affect':83B 'aka':112C 'allow':129C 'apach':19B,38B 'arbitrari':134C 'attack':65B,131C 'auto':78B 'binari':56B 'built/run':31B 'case':158C 'certain':152C 'cgi':5A,24B,33B,36B,110C,115C 'cgi/cgid':40B 'charact':127C 'code':72B,135C 'command':59B,139C 'command-lin':58B,138C 'configur':107C 'cve':10A,13A 'd':53B,157C 'e.g':37B 'equal':125C 'execut':133C 'exploit':20B,92B 'file':80B 'getopt':154C 'handl':119C 'host':29B 'input':82B 'kev':94B 'kev-list':93B 'lack':123C,148C 'line':60B,140C 'list':95B 'mod':39B 'nvd':90B 'option':61B,141C 'paramet':8A 'pass':44B 'php':1A,2A,4A,16A,17A,18A,21B,23B,30B,35B,68B,84B,98C,114C,153C 'php-cgi':3A,22B,34B,113C 'place':137C 'prepend':79B 'proper':118C 'queri':6A,45B,120C,144C 'rce':25B 'read':67B 'relat':146C 'remot':64B,130C 'run':71B 'runtim':26B 'sapi/cgi/cgi_main.c':96C 'script':111C 'scriptalia':42B 'self':28B 'self-host':27B 'server':76B 'setup':43B 'sign':126C 'skip':150C 'sourc':69B 'string':7A,46B,121C,145C 'unauthent':63B 'user':77B 'via':81B 'vulner':9A 'web':75B 'x':103C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2012-05-11T10:15:48+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2012-1823","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2012-1823","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:32+00:00","note":null},{"source":"epss","external_id":"CVE-2012-1823","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-1823","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2012-1823:63","url":null,"severity":null,"published_at":"2026-10-23T21:22:40+00:00","modified_at":"2026-10-23T21:22:40+00:00","first_seen_at":"2026-10-23T21:22:40+00:00","fetched_at":"2026-10-23T21:22:40+00:00","note":"Read CERT/CC VU#520827, PHP bug 61910, PHP 5.4.2/5.3.12 changelog commit, RHSA-2012:0546, NVD. Initial fix 5.3.12/5.4.2 (3 May 2012); CERT/CC says 5.3.13/5.4.3 are the releases to use (initial fix reported incomplete; I did not read the follow-up CVE page). PoC trivial and public in the bug report (?-s). Exploited: CISA KEV, SSVC active."},{"source":"nvd","external_id":"CVE-2012-1823","url":"https://nvd.nist.gov/vuln/detail/CVE-2012-1823","severity":null,"published_at":"2012-05-11T10:15:48+00:00","modified_at":"2026-06-16T23:40:22+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":955,"url":"https://www.kb.cert.org/vuls/id/520827","title":"VU#520827 PHP-CGI query string parameter vulnerability","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":956,"url":"https://bugs.php.net/61910","title":"PHP Sec Bug #61910","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":957,"url":"https://news-web.php.net/php.webmaster/13444","title":"PHP 5.4.2 and 5.3.12 release / ChangeLog","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":958,"url":"https://access.redhat.com/errata/RHSA-2012:0546.html","title":"RHSA-2012:0546 php security update","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":959,"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-1823","title":"NVD CVE-2012-1823","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}